IN THE CLAIMS 

1. (Currently Amended) A system for identifying users of a plurality of computers 
within an organization's communications network, comprising: 

a database storing the organization's directory informatio n, the directory information 
including user identification information but not requiring a list of devices for a plurality of 
us e r s authoriz e d to us e th e plurality of comput e rs within th e communications n e twork ; 

a name discovery apparatus for extracting Int e rn e t Protocol and e l e ctronic mail 
address e s user identification information and associated Internet Protocol addresses , having 
at least one connection to a primary switch in the communications network for passively 
monitoring capturing inbound and outbound e l e ctronic mail traffic thru the primary switch ; 
and 

a server, connected to the name discovery apparatus and having access to the database 
via the communications network, the server having a server process capable of joining said 
inbound and outbound e l e ctronic mail traffic captur e d by said nam e discov e ry apparatus and 
said directory information stor e d in said database, wh e r e in which of th e plurality of users is 
using which of th e plurality of comput e rs matching the user identification information from 
the directory information with the user identification information and current Internet 
Protocol addresses extracted by the discovery apparatus, creating a relationship between the 
directory information and current Internet Protocol addresses of computers currently in use 
by a contact in the directory information . 

2. (Previously Presented) The system of Claim 1, wherein the communications 
network is a local area network. 

3. (Currently Amended) The system of Claim 2, wherein [[said]] the local area 
network is an Ethernet network. 

4. (Deleted) 
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5. (Currently Amended) The system of Claim 1, further comprising: 

a central repository, accessible by said nam e the discovery apparatus and a Web 
server, for storing the said inbound and outbound electronic mail traffic monitored captur e d 
by said nam e the discovery apparatus. 

6. (Currently Amended) The system of Claim 1, wherein [[said]] the database is a an 
ITU T X.500 formatted database. 

7. (Currently Amended) The system of Claim 1, wherein [[said]] the database 
contains at l e ast on e of the following fields of data r e lating to said plurality of users : (i) First 
Name : (ii) Last Nam e : and (iii) E mail Addr e s s and Last Name; and (ii) electronic mail 
address and/or user name. 

8. (Currently Amended) The system of Claim 1, wherein [[said]] the server process 
is a Web server process capable of responding to browser-based queries to identify which ef 
said plurality of us e rs user is using which of the plurality of computers computer. 

9. (Currently Amended) The system of Claim 1, wh e r e in said inbound and outbound 
e l e ctronic mail traffic captur e d by said nam e discov e ry apparatus includ e s at l e ast on e of th e 
following: (I) POP e l e ctronic mail traffic; (ii) IMAP e l e ctronic mail traffic; and (iii) SMTP 
electronic mail traffic 7, wherein the database also contains one of the following fields of 
data: (i) Middle Initial: (ii) Nick Names; (iii) Name Aliases: (iv) Building: (V) Room: (vi) 
Permanent E-mail; (vii) Temporary E-mail; or (viii) Affiliation/Organization . 

10. (Currently Amended) A method for identifying users of a plurality of computers 
within an organization's communications network, the method comprising the steps of: 

monitoring capturing inbound and outbound el e ctronic mail traffic from through a at 
least one primary switch in the communications network; 
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extracting Internet Protocol addr e ss e s and e l e ctronic mail addr e ss e s user 
identification information and associated Internet Protocol addresses from said captur e d the 
monitored inbound and outbound e l e ctronic mail traffic; 

accessing a database of the organization's directory information, for a plurality of 
user s authoriz e d to us e th e plurality of comput e rs within the communications n e twork, said 
databas e the directory information comprising a plurality of e l e ctronic mail addr e ss e s user 
identification information but not requiring a list of devices e ach corr e sponding to on e of said 
plurality of us e rs ; and 

joining said extract e d e l e ctronic mail addresses matching the user identification 
information from the directory information with said plurality of electronic mail address e s 
stor e d in said databas e , th e r e by mapping a subs e t of said e xtract e d Int e rn e t Protocol 
addr e ss e s to a subs e t of said plurality of users wh e r e in which of the plurality of users is using 
which of the plurality of comput e rs is id e ntifi e d the user identification information and 
current Internet Protocol addresses extracted by the discovery apparatus, creating a 
relationship between the directory information and current Internet Protocol addresses of 
computers currently in use by a contact in the directory information . 

1 1 . (Currently Amended) The method of Claim 10, further comprising the step of: 
storing said e xtract e d Internet Protocol address e s and electronic mail addr e ss e s the 

user identification information and associated Internet Protocol addresses in a central 
repository. 

12. (Currently Amended) The method of Claim 11, further comprising the steps of: 
accessing [[said]] the central repository; and 

producing a data file, on a pre-determined time interval, [[said]] the data file 
containing information on which of said plurality of users user used which of th e plurality of 
comput e rs computer during [[said]] the pre-determined time interval. 
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13. (Currently Amended) The method of Claim [[10]] 32, wherein [[said]] the 
extracting step comprises the step of: 

using pattern matching based upon a known electronic mail protocol and/or 
authentication protocol to extract said Int e rn e t Protocol addr e ss e s and said electronic mail 
addr e ss e s the electronic mail address and/or user name and associated Internet Protocol 
address from said captur e d the monitored inbound and outbound e l e ctronic mail traffic. 

14. (Deleted) 

15. (Previously Presented) The method of Claim 1 0, wherein the communications 
network is a local area network. 

16. (Currently Amended) The method of Claim 15, wherein [[said]] the local area 
network is an Ethernet network. 

17. (Deleted) 

18. (Currently Amended) The method of Claim 10, wherein [[said]] the database is a 
an ITU T X.500 formatted database. 

19. (Currently Amended) The method of Claim 10, further comprising the step of: 
receiving, via the communications network, a query to identify a user of one of the 

plurality of comput e rs a computer within the communications network, [[said]] the query 
including an Internet Protocol address; and 

responding to [[said]] the query using the matching said mapping of [[said]] a subset 
of [[said]] the extracted Internet Protocol addresses to said with a subset of said plurality of 
users, [[and]] using [[said]] the received Internet Protocol address. 

20. (Currently Amended) The method of Claim 10, wherein [[said]] the database 
furth e r compris e s at l e ast on e of contains t he following fields of dat a for each of said 
plurality of us e rs : (i) First Name and Last Name; and (iO electronic mail address and/or user 
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name. ; (ifl Last Name; (iip Middl e Initial; (iii) Nick Nam e s; (iv) Namo Aliases; (v) Building; 
(vi) Room; (vii) U s er Nam e ; and (viii) Affiliation/Organization. 

21 . (Currently Amended) The method of Claim 20, further comprising the step of: 
receiving, via the communications network, a query to identify a user of on e of th e 

plurality of comput e rs a computer w ithin the communications network, [[said]] die query 
including at least one of [[said]] the fields of data; and 

responding to [[said]] the query using said mapping the matching of [[said]] a subset 
of [[said]] the extracted Internet Protocol addresses to [[said]] a subset of said plurality of 
users and using said areceived at l e ast on e of said fi e lds field of data. 

22. (Currently Amended) A computer program product comprising a computer 
usable medium having instructions and control logic stored therein for causing a computer to 
execute instructions to identify users of a plurality of terminals within an organization's 
communications network, [[said]] the control logic comprising: 

first computer readable program code means for causing the computer to capture 
monitor inbound and outbound e l e ctronic mail traffic from at l e ast on e through a primary 
switch in the communications network; 

second computer readable program code means for causing the computer to extract 
Internet Protocol addr e ss e s and electronic mail addr e ss e s user identification information and 
associated Internet Protocol addresses from said captur e d inbound and outbound e l e ctronic 
mail the monitored t raffic; 

third computer readable program code means for causing the computer to access a 
database of the organization's directory information for a plurality of users authorized to us e 
the plurality of t e rminals within th e communications n e twork , said database the directory 
information comprising a plurality of e l e ctronic mail addr e ss e s user identification 
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information but not requiring a list of devices , e ach corr e sponding to on e of said plurality of 
users* and 

fourth computer readable program code means for causing the computer to join said 
e xtracted e l e ctronic mail addresses match the user identification information from the 
directory information with said plurality of e l e ctronic mail address e s stored in said databas e , 
th e r e by mapping a subs e t of said extract e d Int e rn e t Protocol addresses to a subset of said 
plurality of us e rs the user identification information and current Internet Protocol addresses 
extracted by the discovery apparatus ; 

wherein the matching creates a relationship between the directory information and 
current Internet Protocol addresses of computers currently in use by a contact in the directory 
information which of th e plurality of us e rs is using which of th e plurality of computers is 
id e ntifi e d . 

23. (Currently Amended) The computer program product of Claim 22, further 
comprising: 

fifth computer readable program code means for causing the computer to store [[said]] 
the extracted Internet Protocol addr e ss e s and e l e ctronic mail addr e ss e s user identification 
information and associated Internet Protocol addresses in a central repository. 

24. (Currently Amended) The computer program product of Claim 23, further 
comprising: 

sixth computer readable program code means for causing the computer to access 
[[said]] the central repository; and 

seventh computer readable program code means for causing the computer to create a 
data file, on a pre-determined time interval, [[said]] the data file containing information on 
which of said plurality of users user u sed which of th e plurality of t e rminals terminal during 
[[said]] the pre-determined time interval. 
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25. (Currently Amended) The computer program product of Claim [[22]] 33, 
wherein [[said]] the second computer readable program code means comprises: 

fifth computer readable program code means for causing the computer to perform 
pattern matching based upon a known electronic mail protocol and/or authentication protocol 
to extract said Int e rnet Protocol addr e ss e s and said e l e ctronic mail addr e sses the electronic 
mail address and/or user name and the associated Internet Protocol address from said 
captur e d the monitored inbound and outbound el e ctronic mail traffic. 

26. (Deleted) 

27. (Currently Amended) The computer program product of Claim 22, wherein 
[[said]] the database is a an ITU T X.500 formatted database. 

28. (Currently Amended) The computer program product of Claim 22, further 
comprising: 

fifth computer readable program code means for causing the computer to receive, via 
the communications network, a query to identify a user of on e of th e plurality of terminate a 
terminal within the communications network, [[said]] the query including an Internet 
Protocol address; and 

sixth computer readable program code means for causing the computer to respond to 
[[said]] the query using [[said]] the matching mapping of [[said]] a subset of [[said]] the 
extracted Internet Protocol addresses to said with a subset of said plurality of users, and using 
a received Internet Protocol address. 

29. (Currently Amended) The computer program product of Claim 22, wherein 
[[said]] the database further comprises at least on e of contains t he following fields of data fef 
e ach of said plurality of us e rs; (i) First Name and Last Name; and (ii) electronic mail address 
and/or user name ; (ii) Last Nam e ; (iii) Middle Initial; (in) Nick Names; (iv) Name Alias e s; 
(v) Building; (vi) Room; (vii) User Name; and (viii) Affiliation/Organization . 
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30. (Currently Amended) The computer program product of Claim 29, further 
comprising: 

fifth computer readable program code means for causing the computer to receive, via 
the communications network, a query to identify a user of ono of th e plurality of t e rminal s a 
terminal within the communications network, [[said]] the query including at least on e of said 
fields a field of data; and 

sixth computer readable program code means for causing the computer to respond to 
[[said]] the query using [[said]] the mapping matching of [[said]] a subset of [[said]] the 
extracted Internet Protocol addresses to said with a subset of said plurality of users, [[and]] 
using a r e c e iv e d at l e ast one of said the fields of data. 

3 1 . (New) The system of Claim 1 , wherein the user identification includes an 
electronic mail address and/or a user name. 

32. (New) The method of Claim 10, wherein the user identification includes an 
electronic mail address and/or a user name. 

33. (New) The computer program product of Claim 22, wherein the user 
identification includes an electronic mail address and/or a user name. 

34. (New) The method of Claim 20, wherein the database also contains one of the 
following fields of data: (i) Middle Initial; (ii) Nick Names; (iii) Name Aliases; (iv) Building; 
(v) Room; (vi) Permanent E-mail; (vii) Temporary E-mail; or (viii) Affiliation/Organization. 

35. (New) The computer program product of Claim 29, wherein the database also 
contains one of the following fields of data: (i) Middle Initial; (ii) Nick Names; (iii) Name 
Aliases; (iv) Building; (v) Room; (vi) Permanent E-mail; (vii) Temporary E-mail; or (viii) 
Affiliation/Organization. 
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